CVE-2017-16912: Medium severity Linux Linux kernel vulnerability
Last updated 29 November 2024
Other sources
The "getpipe()" function (drivers/usb/usbip/stubrx.c) in the Linux Kernel before version 4.14.8, 4.9.71, and 4.4.114 allows attackers to cause a denial of service (out-of-bounds read) via a specially crafted USB over IP packet.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1 - Upgrade
Upgrade
Linux Kernelto a version that resolves this vulnerability.Fixed in 4.14.8 - Upgrade
Upgrade
Linux Kernelto a version that resolves this vulnerability.Fixed in 4.9.71 - Upgrade
Upgrade
Linux Kernelto a version that resolves this vulnerability.Fixed in 4.4.114
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2017-16912.
What is the description of the vulnerability?
The vulnerability allows attackers to cause a denial of service (out-of-bounds read) via a specially crafted USB over IP packet.
How can the vulnerability be exploited?
The vulnerability can be exploited by sending a specially crafted USB over IP packet.
What versions of the Linux Kernel are affected?
The vulnerability affects Linux Kernel versions before 4.14.8, 4.9.71, and 4.4.114.
Are there any available remedies?
Yes, there are available remedies provided by the Ubuntu Linux packages with specific versions mentioned in the reference link.